diff --git a/deploy/kessel-relations-deploy.yaml b/deploy/kessel-relations-deploy.yaml
index de5bfe7..78bab96 100644
--- a/deploy/kessel-relations-deploy.yaml
+++ b/deploy/kessel-relations-deploy.yaml
@@ -14,6 +14,21 @@ objects:
         datastoreEngine: postgres
       secretName: spicedb-config
       patches:
+      - kind: Job
+        patch:
+          spec:
+            template:
+              spec:
+                containers:
+                  - name: migrate
+                    volumeMounts:
+                      - mountPath: /etc/tls/rds.pem
+                        name: rds-tls
+                        subPath: db.ca_cert
+                volumes:
+                  - name: rds-tls
+                    secret:
+                      secretName: kessel-relations-spicedb
       - kind: Deployment
         patch:
           spec: